Large enterprises have large information technology (IT) security budgets and layered IT security systems, yet network compromises, damage from viruses and worms, and spyware problems are common. Current IT security technologies are expensive to maintain and do not provide protection against many new or unknown threats, while new threats are distributed, detected, and reported at increasing rates.
Security solutions which are located at the network perimeter, such as firewalls, have visibility limited to network traffic which passes directly through them. Entry vectors such as email viruses, web browser exploits, wireless access, VPN's, instant messaging, and file-sharing create an increasingly porous perimeter which bypasses these technologies. It is hard to define a perimeter in a modern network which provides sufficient control and visibility. Many attacks only generate network traffic after they have compromised a machine or network. For instance, by the time a virus starts emailing from a machine within a network, that machine is already compromised. To stop attacks before they execute, it is generally necessary to protect files, not just network traffic.
Visibility and protection can be provided by a host agent, which is software, sometimes used in conjunction with hardware, which operates on multiple individual computers, “hosts,” within the network. Host agents generally work in parallel, using some of the host's resources to perform security functions in the background. By potentially having access to all significant internal functions of a host, host agents can in theory detect and stop threats on hosts before any damage is done. Host agent security systems are sometimes called Endpoint Security Systems, because they operate on the “ends” of the network.
Current enterprise endpoint security systems often attempt to detect and block attacks with known bit patterns, such as anti-virus (AV) scanning and anti-spyware (AS) scanning. Pattern scanning uses blacklists of patterns which are pre-identified as bad. Similarly, some security systems use detected known behavioral profiles, which can be described as a blacklist of bad behavioral patterns. In both cases, blacklists are perpetually out of date, unable to respond to attacks which are new or unknown. Blacklists are also ineffective against attacks such as new viruses which can spread faster than the ability to derive, test, and distribute blacklist updates. With dozens of new viruses discovered each week, blacklists of all kinds become increasingly ineffective. Behavior patterns are complex to develop and test, and as a result they have high false-alarm rates; that is, they erroneously conclude a behavior is bad when in fact it is benign. As new attacks evolve, behaviors change, leading to errors of missed detection instead. By waiting until an attack, like a virus, exhibits a bad behavior, the affected machine may be already compromised. In summary, blacklists attempt to track what is already known to be wrong, while what is wrong is constantly changing.
Another enterprise endpoint technology is anomaly detection. This can be viewed as behavioral blacklisting which is determined statistically by observing behaviors over time. In addition to inheriting the shortcomings of behavioral blacklists, anomaly detection adds new error modes as both good and bad behaviors are estimated statistically, so there are certain to be estimation errors. This process often leads to unacceptably high false-alarm and missed-detection rates.
Another class of endpoint security systems limits execution to only programs which are on whitelists, which are lists of patterns of known good programs. If a program is not included in the list, it will not run. Such a system is not flexible enough for a typical modern enterprise, and the resulting whitelists are difficult to maintain. For instance, most large enterprises deploy custom programs that are developed in-house and that can change frequently. Further, these programs may contain sensitive intellectual property and security risks which should not be exposed to a third party. It is unlikely a whitelist vendor would have access to pre-approve this software in a timely fashion. Other examples are operating system and other updates. Again, there is no central clearinghouse or central authority to certify that certain programs or updates are good for all enterprises. The failure modes of whitelist systems are severe, blocking access to critical, but not yet approved, applications and business functions.
As a result, systems which centrally classify file content access into only one or two states, Approved and Banned, will have issues with race (timing) conditions. A large amount of software does not clearly fit into either category, and there is no central authority which will be universally trusted for all software within an enterprise. Even when this is not a factor, it can take time to classify the intermediate software. In the case of a new virus, it can take 6-48 hours or more to classify a new virus as bad, and by then the outbreak can be a pandemic. So even with strong network connectivity from the host to the central approval authority, it can take longer than a few minutes to detect and analyze new software. To transparently add this content-based authorization to an operating system in the background, the delays must typically be less than one minute, or else the file system can time out, and false access-blocking errors occur.